VLESS or Shadowsocks: what is the difference

VLESS and Shadowsocks are often mentioned together, but they are built in opposite ways. Understanding the difference explains why a good VPN keeps both.

#Shadowsocks 2022

Shadowsocks started as a simple encrypted proxy. The modern version, Shadowsocks 2022 (the SIP022 specification), uses AEAD ciphers such as 2022-blake3-aes-256-gcm, BLAKE3-based keys, replay protection and timestamps.

Its defining trait: Shadowsocks has no handshake that looks like anything known. From the first byte the whole stream looks like random data.

• Pros: very light, low latency, little overhead, works over both TCP and UDP.
• Cons: "fully random" traffic has itself become a signal. Some filtering systems block connections that do not look like any known protocol.

#VLESS with Reality

VLESS is a minimal protocol from Xray that encrypts nothing itself and relies on its transport. Paired with Reality, it looks like an ordinary TLS 1.3 connection to a real, popular site with a browser's TLS fingerprint. A scanner that connects to the server sees the real site. Details in What is VLESS Reality.

• Pros: hard to tell from HTTPS, resists active probing, needs no certificate of its own.
• Cons: runs over TCP, so it is slower than QUIC protocols on lossy networks; more complex to set up.

#Comparison

#Bottom line

No protocol is best at everything. Shadowsocks 2022 is a good fast option where filtering is light. VLESS Reality is the main choice where DPI actively hunts for VPNs. That is why every Colitu server runs both, plus Hysteria2 and Trojan, and the app picks the one that gets through on your network.